About the Amazon S3 Activity Log Integration
Amazon S3 Activity Log Integration in Iru Endpoint enables organizations to export unified tenant activity logs to a self-hosted S3 bucket for centralized collection and analysis with SIEM services.How It Works
This integration pushes event data to your specified S3 bucket using cross-account access via an Iru Endpoint-provided IAM role. Once configured, it delivers the same tenant activity events you review on Unified Activity. That includes activity across Tenant (System), Endpoint, Detections, Vulnerabilities, and Compliance. Use Unified Activity to browse and filter what was recorded; use your S3 bucket for long-term storage, SIEM ingestion, or offline analysis. For event field definitions and API details, refer to the activity log API documentation.The first log collection after the Integration is connected only includes the previous hour of activity. Subsequent activity log collection will occur hourly.
Prerequisites
Before configuring this integration, ensure the following:- You have an active AWS account.
- You have permissions to create a new S3 bucket.
- You have permissions to create an IAM Role with AssumeRole and S3 write permissions.
Setting Up AWS Access
Iru Endpoint Integration Setup
1
Open Integrations
In the sidebar, click the Account Menu Button, then select Integrations.
2
Discover Integrations
Click Discover integrations in the upper-right of the Integrations page.
3
Add S3 Integration
Under Security integrations, click Add and configure under Amazon S3 Activity Log Integration.
4
Copy IAM Role
Copy the value for IRU_ENDPOINT_IAM_ROLE and store the value in a secure location.
5
Copy AWS Account ID
Copy the value for IRU_ENDPOINT_AWS_ACCOUNT_ID and store the value in a secure location.
6
Store Values Securely
These values will be used as part of your IAM role permissions in the next section.
Creating S3 Bucket
You must create a new S3 Bucket to use the Amazon S3 Activity Log Integration.
1
Access AWS Console
Log in to AWS.
2
Navigate to S3
Navigate to Amazon S3 > Buckets.
3
Create Bucket
Click Create bucket.
4
Select Bucket Type
Choose the General purpose bucket type.
5
Enter Bucket Name
Enter a memorable Bucket name.
- This name will be referenced in policies.
6
Configure Public Access
Under Block Public Access settings for this bucket, ensure that the Block all public access option is selected.
7
Set Versioning
Under Bucket Versioning, keep the Disable option selected.
8
Configure Encryption
Under Encryption type, select Server side encryption with Amazon S3 managed Keys (SSE-S3).
9
Enable Bucket Key
Under Bucket Key, select Enabled.
10
Review Configuration
Iru Endpoint currently only supports the default encryption options defined above.
11
Create Bucket
Click Create bucket.
12
Select Created Bucket
Select the bucket you just created.
13
Access Permissions
Click the Permissions tab.
14
Edit Bucket Policy
Under Bucket policy, click Edit.
15
Add Bucket Policy
Add the following bucket policy to the role permissions. Click Save changes.
1
Replace bucket name references
Replace all reference to BUCKET_NAME with the name of the bucket you just created.
1
Navigate to IAM
In AWS, navigate to IAM > Roles.
2
Create New Role
Click Create role.
3
Select Trust Policy
Select Custom trust policy.
4
Add Custom Trust Policy
Add the Custom trust policy below to allow Iru Endpoint to assume this role when writing to your S3 bucket.
-
Replace the IRU_ENDPOINT_AWS_ACCOUNT_ID and IRU_ENDPOINT_IAM_ROLE text with the values you made a note of at the beginning of the article.
5
Continue Role Creation
Click Next.
6
Skip Permissions
On the Add permissions screen, select Next without selecting any of the listed Permissions policies.
7
Add Role Details
Add a Role name and Description.
8
Complete Role Creation
Click Create role.
9
Select Created Role
Select the IAM Role you just created.
10
Access Permissions Tab
Click on the Permissions tab.
11
Add Permissions
Click Add permissions.
12
Create Inline Policy
Click Create inline policy.
13
Switch to JSON
Click the JSON tab.
14
Enter Inline Policy
Enter the following for the inline policy:
1
Replace bucket name
Replace BUCKET_NAME - replace this with the name of the bucket you created that Iru Endpoint will place the activity log files in.
15
Continue Policy Creation
Click Next.
16
Name Policy
Enter a Policy name.
17
Create Policy
Click Create policy.
Setting Up the Integration in Iru Endpoint
Once the above is configured in your AWS account, you can proceed to setting up the integration in your Iru Endpoint account.1
Open Integrations
In the sidebar, click the Account Menu Button, then select Integrations.
2
Discover Integrations
Click Discover integrations in the upper-right of the Integrations page.
3
Add S3 Integration
Under Security integrations, click Add and configure under Amazon S3 Activity Log Integration.
4
Continue Setup
Click Next.
5
Enter AWS Account ID
Enter the AWS Account ID.
6
Enter S3 Bucket Name
Enter the S3 Bucket Name for the bucket that was created earlier in this guide.
7
Set Destination Path
Optionally, enter a Destination Path.
8
Enter IAM Role ARN
Enter the IAM Role ARN for the IAM Role that was created earlier in this guide.
9
Enter AWS Region
Enter the AWS Region.
10
Connect to S3
Click Connect to S3.
11
Verify Connection
Iru Endpoint will attempt to upload and delete a test file in the provided S3 bucket. If Iru Endpoint is unable to successfully integrate to your S3 bucket, you will not be able to save and will need to follow the error messages surfaced in the UI to fix the connection.
12
Verify Event Data
Check your S3 bucket to confirm that Iru Endpoint is pushing activity log data. This will take a maximum of two hours, provided that tenant activity events have been generated on your account.
Considerations
Activity Log Frequency: Activity log events are updated hourly, with the first collection including only the previous hour of activity. Exported events match Unified Activity scope (all supported Tenant, Endpoint, Detections, Vulnerabilities, and Compliance activity types). IAM Role Permissions: The IAM role must have the necessary permissions to allow Iru Endpoint to assume that role and write to the S3 bucket. S3 Bucket Policy: You may need to adjust the S3 Bucket policy to allow Iru Endpoint to write objects to the bucket. Security Requirements: Ensure the S3 bucket has proper encryption enabled and public access is blocked for security compliance. Data Retention: Consider implementing S3 lifecycle policies to manage log data retention and storage costs. Monitoring: Set up CloudWatch alarms to monitor S3 bucket access and activity log delivery.Related Articles
Unified Activity
Browse, search, and filter the same tenant activity events in the Iru web app before or after they export to S3.
Activity Page
Current Endpoint activity timeline, available alongside Unified Activity while it is in Preview.